6c793bae79
Publish the proposed SignPath Foundation policy with Shantur Rathore as project owner and Pascal Andre as signing operator and approver. Describe source/build provenance, manual signing approval, MFA requirements and artifact verification, with links from the README and to the privacy policy.
2.4 KiB
Code signing policy
Status: proposed policy for the SignPath Foundation application.
Responsibilities
| Role | Maintainer | Responsibilities |
|---|---|---|
| Project owner | Shantur Rathore (@shantur) | Owns project governance, authorizes the signing integration and approves changes to signing responsibilities. |
| Signing operator and approver | Pascal André (@pascalandr) | Coordinates the application, maintains the signing workflow, submits and approves release signing requests, and verifies signed artifacts before publication. |
| Authors and reviewers | Shantur Rathore and Pascal André | Maintain the source and build workflows, and review contributions before they enter the release build. |
Everyone involved in signing must use multi-factor authentication for GitHub and SignPath access.
Signing provider
The proposed provider is SignPath.io, with a certificate provided by SignPath Foundation, subject to acceptance into its open-source program. Certificates under this program identify SignPath Foundation as the publisher.
The attribution for releases signed through the program will be:
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
Release signing
- Windows CodeNomad executables and installers are built from the public CodeNomad repository on GitHub-hosted Actions runners, from an identified release commit.
- The signing workflow uploads the build artifacts to GitHub Actions and submits them to SignPath for origin verification and signing.
- Pascal André reviews and manually approves each release signing request.
- The workflow verifies the returned Authenticode signatures, timestamp and product version before publishing the signed artifacts.
- Tauri updater signatures and checksums are generated from the final signed files. Release records identify the source commit and build workflow.
Signing access and policy changes are reviewed by the project owner. The operator investigates failed verifications and reported signing-policy issues.
Privacy
CodeNomad's network connections and data handling are described in the Privacy policy.